In traditional computing systems, communication between computers is either code (a software application)or data (a file containing information)and there is no notion of a program moving between hosts while it is being executed. Thus, with a typical computing system, a person may execute a software application (e. g., Microsoft Word) on his own computer and then forward the results of the execution of the software application (e. g., a Word document) to another user. The other user may then view the Word document by executing his own copy of Microsoft Word. A user may also send another user an executable software application file that the other user may download and execute on his own computer. However, these traditional computing systems do not recognize a single instantiation of a software program that may be executed by one or more different computers in order to complete the execution of the software application.
A jumping application, sometimes also called a jumping app, a mobile application, a mobile app, or a mobile agent, is a computer software application/program, or part of a computer program that can physically move from one computer to another (between hosts) while it is being executed: A jumping application's software may or may not have been previously installed on a particular computers prior to the arrival of the jumping application. The jumping applications are said to jump from one computer to another computer and the process of jumping from one computer to another computer is also referred to as a jump.
The process of initiating a jump between computers is commonly known as a dispatch. Typically, each jumping application will carry with it an ordered list or tree of hosts which the jumping application must visit during its execution, and such a list or tree is called the jumping application's itinerary. The computers that can receive and dispatch jumping applications are called hosts. The collection of hosts, computer networks, and software which executes and supports the jumping applications, and the jumping applications themselves, is called the jumping application system.
A jumping application typically has at least two parts: the state and the code. The state of the jumping application contains all of the data stored, carried, used, and/or computed by the particular jumping application. The code of the jumping application is the set of computer instructions which the host computer is intended to carry out on behalf of the jumping application during the execution of the jumping application by the particular host computer. In addition, a jumping application may have other parts, including an Access Control List (ACL), an itinerary, a datastore, an audit log, etc. A jumping application's software may or may not have been previously installed on the computers prior to the arrival of the jumping application.
Jumping applications have demonstrable benefits for computer systems. However, they also create security problems. In particular, a hostile host computer might tamper with the code, the state, or the configuration of a jumping application before dispatching it to another host, in order to attack that host or another part of the jumping application system. Thus, there is a need to ensure that a host computer cannot adversely alter the configuration of a jumping application.
Current implementations of jumping application systems support techniques to ensure that any code transmitted to a host computer comes from a location which is known (or believed) to be safe. This is accomplished by simply preventing any untrusted host from transmitting any executable code. Current implementations are binary: either a host can transmit code to other hosts, or a host cannot transmit code to another host.
However, current jumping application implementations do not adequately handle the situation in which an untrusted host needs to specify the behavior of a jumping application on another host. Thus, it is desirable to provide a system which allows an untrusted host to specify the behavior of a jumping application when that jumping application is on another host and it is to this end that the present invention is directed.